CVE-2018-20060

Published: Dec 11, 2018Modified: Dec 27, 2024

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.

Affected (4)

Products: Python: Urllib3 · Fedoraproject: Fedora

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Python Urllib3	Before 1.23

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 28
Fedoraproject Fedora	Version 29
Fedoraproject Fedora	Version 30

References (23)

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html

Source: cve@mitre.org

https://access.redhat.com/errata/RHSA-2019:2272

Source: cve@mitre.org

https://bugzilla.redhat.com/show_bug.cgi?id=1649153

Source: cve@mitre.org

Issue TrackingMitigationPatchThird Party Advisory

https://github.com/urllib3/urllib3/blob/master/CHANGES.rst

Source: cve@mitre.org

Release NotesThird Party Advisory

https://github.com/urllib3/urllib3/issues/1316

Source: cve@mitre.org

Third Party Advisory

https://github.com/urllib3/urllib3/pull/1346

Source: cve@mitre.org

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5SJERZEJDSUYQP7BNBXMBHRHGY26HRZD/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BXLAXHM3Z6DUCXZ7ZXZ2EAYJXWDCZFCT/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWP36YW3KSVLXDBY3QJKDYEPCIMN3VQZ/

Source: cve@mitre.org

https://usn.ubuntu.com/3990-1/

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://access.redhat.com/errata/RHSA-2019:2272

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=1649153

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingMitigationPatchThird Party Advisory

https://github.com/urllib3/urllib3/blob/master/CHANGES.rst

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesThird Party Advisory

https://github.com/urllib3/urllib3/issues/1316

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://github.com/urllib3/urllib3/pull/1346

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5SJERZEJDSUYQP7BNBXMBHRHGY26HRZD/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BXLAXHM3Z6DUCXZ7ZXZ2EAYJXWDCZFCT/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWP36YW3KSVLXDBY3QJKDYEPCIMN3VQZ/

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.netapp.com/advisory/ntap-20241227-0010/

Source: af854a3a-2127-422b-91ae-364da2661108

https://usn.ubuntu.com/3990-1/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.